[0.84] Route validation npm requests through package proxy

.ado/README.md

@@ -50,14 +50,15 @@ All repository resources pin `ref: refs/tags/release`.
 ## Package feed and network isolation
 
 ISS agents run under 1ES **Network Isolation**, which blocks egress to public CDNs.
-The pipelines source packages only from the `ms/react-native-public` Azure Artifacts
-feed and neutralize three background egress attempts that green builds would
-otherwise hide:
-
-- **Feed registry:** `variables/shared.yml` points npm and Yarn at the
-  `ms/react-native-public` feed (`NPM_CONFIG_REGISTRY` / `YARN_NPM_REGISTRY_SERVER`).
-  On CI, `templates/auth-npm-feed.yml` mints a managed-identity token and writes it
-  to `~/.npmrc` and `~/.yarnrc.yml` before any install.
+The pipelines route package requests through approved endpoints and neutralize
+three background egress attempts that green builds would otherwise hide:
+
+- **Package registries:** `variables/shared.yml` routes npm/npx and Yarn through
+  the anonymous PackageFeedProxy (`NPM_CONFIG_REGISTRY` /
+  `YARN_NPM_REGISTRY_SERVER`). On CI, `templates/auth-npm-feed.yml` mints a
+  managed-identity token for direct access to the `ms/react-native-public`
+  Azure Artifacts feed. The token is scoped to that feed in `~/.npmrc` and
+  passed separately to the Verdaccio uplink; Yarn does not send it to the proxy.
 - **Verdaccio (CLI init tests):** `verdaccio/generate-config.js` emits the config at
   runtime, so the uplink targets the feed (with the CI token when present) while
   local packages still publish offline. The former static `config.yaml` was removed.
@@ -69,10 +70,11 @@ otherwise hide:
   CDN mid-build. This is an interim step; the durable fix is to bake it into the
   agent image.
 
-Public PR builds read this feed **anonymously**, so they can only restore versions
-an authenticated identity has already saved. A scheduled feed warm-up (maintained on
-`main`, branch-agnostic) pre-populates the npm and NuGet dependency closures on the
-feed and keeps those anonymous restores working.
+Public PR Verdaccio and NuGet restores read the Azure Artifacts feed
+**anonymously**, so they can only restore versions an authenticated identity has
+already saved. A scheduled feed warm-up (maintained on `main`, branch-agnostic)
+pre-populates the npm and NuGet dependency closures on the feed and keeps those
+anonymous restores working.
 
 ## SDL and Component Governance
 

.ado/build-template.yml

@@ -164,7 +164,7 @@ extends:
               version: '24.x'
             displayName: Use Node.js 24.x
 
-          # CI is network-isolated; authenticate to the package feed before any npm/Yarn use.
+          # CI is network-isolated; acquire the feed token used by the Verdaccio uplink.
           - ${{ if eq(parameters.buildEnvironment, 'Continuous') }}:
             - template: .ado/templates/auth-npm-feed.yml@self
 

.ado/templates/auth-npm-feed.yml

@@ -1,4 +1,4 @@
-# Authenticates npm and Yarn 4 to the ms/react-native-public feed with the build's managed identity.
+# Acquires a managed-identity token for direct npm requests and the Verdaccio feed uplink.
 steps:
 - task: AzureCLI@2
   displayName: Authenticate to the package feed
@@ -13,4 +13,3 @@ steps:
       Write-Host "##vso[task.setvariable variable=RNW_NPM_FEED_TOKEN;issecret=true]$token"
       $reg = '//pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/'
       Set-Content -Path (Join-Path $env:USERPROFILE '.npmrc') -Encoding ascii -Value "${reg}:_authToken=$token"
-      Set-Content -Path (Join-Path $env:USERPROFILE '.yarnrc.yml') -Encoding ascii -Value @('npmAlwaysAuth: true', "npmAuthToken: $token")

.ado/templates/prepare-js-env.yml

@@ -23,7 +23,7 @@ steps:
     displayName: Ensure npm directory for npx commands
     condition: eq(variables['Agent.OS'], 'Windows_NT')
 
-  # CI is network-isolated; authenticate to the package feed before install.
+  # CI is network-isolated; acquire the feed token used by the Verdaccio uplink.
   - ${{ if eq(parameters.buildEnvironment, 'Continuous') }}:
     - template: auth-npm-feed.yml
 

.ado/variables/shared.yml

@@ -6,9 +6,9 @@ variables:
   NPM_CONFIG_YES: false
   NPM_CONFIG_CACHE: $(Agent.TempDirectory)/.npmCache
 
-  # Route npm/Yarn through the ms/react-native-public feed (npmjs upstream) on isolated agents
-  NPM_CONFIG_REGISTRY: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/
-  YARN_NPM_REGISTRY_SERVER: https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/npm/registry/
+  # Route npm and Yarn through the anonymous proxy so validation does not require feed authentication.
+  NPM_CONFIG_REGISTRY: https://packagefeedproxy.microsoft.io/npm/
+  YARN_NPM_REGISTRY_SERVER: https://packagefeedproxy.microsoft.io/npm/
 
   # Stop React Native DevTools from fetching its standalone shell binary via DotSlash from a
   # Facebook CDN on dev-server start, which is blocked under network isolation. The 'dev'